Cleanup of /var/asl/data/audit/

Customer support forums for Atomic Protector (formerly Atomic Secured Linux). There is no such thing as a bad question here as long as it pertains to using Atomic Protector. Newbies feel free to get help getting started or asking questions that may be obvious. Regular users are asked to be gentle. :-)
lvalics
Forum User
Forum User
Posts: 38
Joined: Thu Feb 22, 2007 3:49 pm
Location: Romania
Contact:

Cleanup of /var/asl/data/audit/

Unread post by lvalics »

Hi,

On a heavy server it is filling up too quickly /var/asl/data/audit/ and I can have gigabytes of data and I see it not take empty after a while so in days I get 20-30GB. How can I cleanup? Is there a command in mod_sec or ASL ?
Best regards,
Valics Lehel

Power Toys for PLESK
HOW TO: Setup a new box with PLESK
PLESK Crash Recovery Service
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Cleanup of /var/asl/data/audit/

Unread post by faris »

Hmmm..although mine isn't big, the sheer number of files in there is causing a problem for me and I would certainly like to get control of this.

I thought this setting in /etc/asl/config might be related:

ASL_DB_RETENTION="5 days"

But it is not -- that's for the DB only from the looks of things (since I have 16 days worth in the audit directory, and given it has "DB" not "audit" in the variable name! ).
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4119
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Cleanup of /var/asl/data/audit/

Unread post by mikeshinn »

This is the setting that controls how long the audit data is kept for WAF events:

https://www.atomicorp.com/wiki/index.ph ... LEAN_ALERT
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Cleanup of /var/asl/data/audit/

Unread post by faris »

ooh, a new one on me. Thanks.
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
Evanion
New Forum User
New Forum User
Posts: 3
Joined: Sun Apr 07, 2013 10:05 am
Location: Sweden

Re: Cleanup of /var/asl/data/audit/

Unread post by Evanion »

I really wish they would store this data in a database ... the number of files is eating up our inodes...
Post Reply